A bug in FFmpeg’s LCL decoder triggers an integer underflow when processing an LCL packet marked for multithreaded ZLIB decompression. Because the packet length is not properly clamped to a minimum of eight bytes, the decoder ends up reading past the end of the allocated buffer, producing a heap out-of-bounds read. An attacker can supply a crafted AVI or MKV file containing a short LCL packet, causing the application to read unintended memory or crash.

All releases of FFmpeg up to and including 9.0.2 are vulnerable. The flaw resides in the libavcodec/lcldec.c code and affects any build lacking the patch introduced in a later commit.

The CVSS score of 6.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The description does not explicitly state the type of access needed; however, based on the description, it is inferred that the vulnerability can be triggered by processing a crafted media file, implying local exploitation on the host running the decoder. Remote exploitation could be possible if the application accepts untrusted media from an external source, but this is not explicitly stated in the advisory.